Oracle and OpenAI announced an expanded partnership on October 27, 2026, bringing ChatGPT, Codex, and OpenAI models closer to Oracle’s enterprise applications and cloud services. One of the central announcements is Oracle AI Workspace, a planned conversational interface connecting information and approved activities across Oracle applications, including NetSuite.
For NetSuite power users, this introduces a different way to investigate financial issues and coordinate work across business systems. Instead of navigating between saved searches, transaction records, reporting applications, and supporting documents, employees would interact with authorized enterprise information through a shared ChatGPT experience.
The partnership also introduces Oracle App Composer for AI-assisted application development, Oracle AI Security Mesh for vulnerability testing, and an AI SMB Bundle combining development tools, cloud credits, and business applications.
For IT leaders, the priority is understanding how these offerings interact with existing NetSuite capabilities and what needs to change before employees begin using AI to retrieve information or initiate business actions.
What Are the Key Offerings in the Oracle-OpenAI Partnership?
The Oracle and OpenAI Partnership announcement introduced four offerings designed for different business requirements. The four new offerings address different challenges. AI Workspaces focuses on accessing enterprise information, App Composer supports application creation, Security Mesh addresses vulnerability assessment, and the SMB Bundle packages selected capabilities for smaller businesses.
| Offering | What it provides | Relevance to NetSuite businesses |
|---|---|---|
| Oracle AI Workspace | Conversational access to connected enterprise applications and approved actions | Planned access to NetSuite information alongside other Oracle systems |
| Oracle AI Security Mesh | AI-assisted identification and remediation of security vulnerabilities | Additional security assessment capabilities for supported applications and infrastructure |
| Oracle App Composer | AI-assisted application creation and managed OCI deployment | Development of internal business applications connected to approved data |
| Oracle AI SMB Bundle | ChatGPT, Codex, Oracle applications, free tiers, and OCI credits | An entry point for eligible smaller businesses adopting AI and NetSuite QuickStart |
Oracle also expanded the availability of OpenAI offerings through Oracle Marketplace.
Eligible US customers can purchase access to the OpenAI API, Codex, and ChatGPT Work through Oracle’s existing procurement channels and apply eligible Oracle Universal Credits.
This simplifies procurement for organizations that already maintain Oracle cloud agreements, although model consumption, licensing, and application development still have their own costs.
How Will Oracle AI Workspace Reduce Application Switching?
Oracle AI Workspace is designed to bring information and approved business activities from connected Oracle applications into ChatGPT.
The purpose is to reduce the effort employees spend moving between systems when investigating problems that require information from several sources.
Investigating Financial Information Across Systems
With Oracle AI Workspace, finance teams will be able to investigate financial discrepancies across connected enterprise applications through a single conversational interface. Instead of switching between NetSuite, procurement systems, planning applications, and document repositories, users will retrieve relevant information through ChatGPT.
During month-end close, a controller could request an analysis of unexpected operating expenses. The workspace is designed to retrieve general ledger (GL) balances, identify contributing transactions, examine related purchase orders, and check outstanding vendor bills or accruals across authorized systems.
The resulting analysis will help finance teams identify the source of discrepancies while retaining references to underlying financial records. This gives employees a consolidated view of financial activity without manually gathering information from multiple applications.
Moving From Information Retrieval to Approved Actions
Oracle AI Workspace is designed to support authorized business actions across connected applications, extending its functionality from retrieving information to coordinating tasks. Users will be able to investigate outstanding purchase orders, check approval statuses, and initiate supported follow-up activities through conversational requests.
These actions will remain subject to the permissions and business rules established in the connected applications. Purchase order approvals should follow the configured approval hierarchy, while journal adjustments require valid accounting information and appropriate authorization
Availability: Oracle describes AI Workspaces as coming soon. Its planned functionality should not be confused with capabilities already enabled in NetSuite accounts.
How Is Oracle AI Workspace Different From Ask Oracle and NetSuite AI Workspaces?
Oracle AI Workspace, Ask Oracle, and NetSuite AI Workspaces address different requirements, even though all three use conversational or agent-based AI.
Ask Oracle Supports Conversational Interaction Within NetSuite
Ask Oracle is part of the NetSuite Next experience. It allows eligible users to interact with NetSuite information through natural language, including supported reporting, analysis, navigation, and business questions.
A finance user could investigate outstanding customer balances or request relevant information without constructing a separate saved search for every question.
The interaction takes place within the supported NetSuite experience and uses the applicable user permissions.
NetSuite AI Workspaces Organize ERP-Specific Activities
NetSuite AI Workspaces are part of the Autonomous Suite direction announced at SuiteWorld 2026. They are intended to bring employees, relevant business information, and AI-assisted activities together around defined ERP processes.
Financial close is one example, where accountants need information about account balances, reconciliation progress, exceptions, and outstanding activities. These workspaces focus on the business context maintained within NetSuite.
Oracle AI Workspace Extends Across Connected Applications
Oracle AI Workspace has a different scope. It is designed to connect Oracle applications, enterprise data, and cloud services within ChatGPT.
This allows an employee to investigate activities involving several enterprise systems rather than working within one application’s interface.
| Capability | Primary role | Availability |
|---|---|---|
| Ask Oracle | Conversational interaction with supported NetSuite information and tasks | Available to eligible customers, subject to rollout |
| NetSuite AI Workspaces | ERP-specific analysis and activities using relevant NetSuite context | Part of the NetSuite Next and Autonomous Suite rollout |
| Oracle AI Workspace | Cross-application information retrieval and approved business actions through ChatGPT | Announced; coming soon |
| NetSuite AI Connector Service | Connects compatible external AI applications to permitted NetSuite tools | Existing supported capability |
Businesses do not need to wait for Oracle AI Workspace to begin evaluating external AI access to NetSuite.
The AI Connector Service already provides a supported connection method.
How Does ChatGPT Connect With NetSuite Today?
NetSuite’s AI Connector Service uses the Model Context Protocol (MCP) to expose supported ERP operations to compatible external AI clients.
MCP defines how the client discovers tools, submits requests, and receives responses.
The connection does not provide unrestricted database access. Instead, it makes defined operations available according to the authenticated NetSuite role and the relevant tool configuration.
How MCP Access Works
A user investigating an overdue customer balance could submit the request through a compatible external AI application. The client identifies an available tool for retrieving relevant customer or transaction information.
NetSuite executes the operation using the authenticated role’s permissions and returns the permitted results. The AI model then interprets the information and prepares its response.
The process involves several distinct stages:
- The employee submits a request.
- The AI client selects an available NetSuite tool.
- The tool receives structured parameters.
- NetSuite validates the request against the applicable permissions.
- The tool retrieves information or performs its supported operation.
- The AI client interprets the returned result.
The MCP Standard Tools SuiteApp provides operations involving records, saved searches, SuiteQL, reports, and other supported functions.
For business-specific requirements, developers also create custom MCP tools through SuiteScript 2.1 and the SuiteCloud Development Framework.
Why Custom Tools Still Matter
Standard tools do not cover every business requirement. A NetSuite environment may contain custom records, customer-specific pricing, unusual transaction validations, or specialized financial calculations.
A custom tool exposes a defined operation that the AI client invokes when needed. The external model handles interpretation and tool selection, while the NetSuite component executes the approved business logic.
Why Does Conversational ERP Access Increase Security Risk?
The principal security concern is that conversational AI makes existing user permissions easier to exercise. NetSuite administrators assign permissions through roles that determine which records, transactions, reports, and functions employees access.
Over time, these roles accumulate exceptions introduced for temporary projects, departmental changes, integrations, and operational requirements.
A role that was appropriate during implementation may no longer reflect an employee’s current responsibilities.
Existing Permissions Become More Accessible
An employee may retain permission to view sensitive vendor records after moving to another department. Another role may include transaction editing rights even though its current users only need reporting access.
Traditional ERP interfaces require employees to navigate to the relevant records or reports.
Conversational AI reduces that navigation. A user could request information directly, without knowing where the underlying record is located.
The risk is not that ChatGPT automatically bypasses NetSuite permissions. The risk is that excessive permissions become easier to use.
This is why a conventional access review is insufficient when businesses introduce AI connectivity.
Administrators need to understand both the user’s permissions and the operations exposed through the AI connection.
What Should NetSuite Administrators Review?
| Security area | What needs to be verified |
|---|---|
| User roles | Permissions still reflect current business responsibilities |
| Sensitive records | Confidential customer, vendor, employee, and financial information remains appropriately restricted |
| Transaction access | Reporting permissions are separated from unnecessary create, edit, approve, or delete permissions |
| Subsidiaries | Users access only the subsidiary information relevant to their responsibilities |
| Custom MCP tools | Tool inputs, exposed operations, record access, and validation rules are appropriately restricted |
| Authorization grants | Existing connections can be reviewed and revoked when access requirements change |
For example, a finance employee may legitimately need to retrieve vendor bills for reporting.
That does not automatically justify permission to change vendor banking details.
When an AI client connects to NetSuite, those differences need to be reflected in the available tools and underlying role permissions.
Folio3’s NetSuite Next Readiness Assessment provides a relevant starting point for reviewing existing configurations, permissions, and AI adoption requirements.
What Does Oracle AI Security Mesh Add to Enterprise Security?
Oracle AI Security Mesh is a newly announced security offering that uses OpenAI cyber models to help organizations identify and address vulnerabilities in applications and infrastructure.
It is designed to support authorized security testing rather than replace identity management or application-level permissions.
How AI Security Mesh Works
Enterprise security testing involves examining applications, infrastructure configurations, and potential weaknesses that attackers could exploit.
Security teams traditionally use scanning tools, penetration testing, configuration reviews, and manual investigation to identify vulnerabilities.
Oracle AI Security Mesh introduces advanced AI capabilities into this process.
According to the Oracle and OpenAI announcement, Oracle manages the testing infrastructure while customers authorize the scope of security activities.
This distinction matters because vulnerability assessment tools must operate within defined boundaries.
The use of AI does not authorize testing applications, infrastructure, or systems outside the approved scope.
The offering is intended to help security teams identify vulnerabilities and support remediation, with Oracle’s underlying security capabilities providing additional protections for supported environments.
How Does This Relate to NetSuite?
NetSuite security involves role permissions, authentication, customizations, integrations, and transaction controls.
AI Security Mesh should not be interpreted as an automatic audit of every NetSuite user’s access rights or a guarantee that custom SuiteScripts and MCP tools are secure.
These controls operate at different levels.
AI Security Mesh addresses security assessment for supported applications and infrastructure. NetSuite permissions determine who accesses ERP data and which operations they perform.
For instance, vulnerability testing could help identify weaknesses in a supported custom application connected to NetSuite.
However, identifying whether an employee has excessive access to vendor payment information requires a separate review of the relevant NetSuite roles and permissions.
The security model therefore needs both technical vulnerability management and business application access governance.
How Does Oracle App Composer Support Citizen Developers?
Oracle App Composer is designed to help employees build and share applications using Codex and other AI development tools, with Oracle managing deployment and operations through OCI.
The announcement addresses a recurring problem with employee-developed applications.
Creating an initial application has become easier with AI-assisted coding, but deploying it securely, connecting enterprise data, and maintaining it requires additional work.
App Composer is intended to provide a managed environment for those activities.
What Can Employees Build With App Composer?
Employees describe the application requirements, use Codex-assisted development, and connect the resulting application to approved business information.
For example, a finance team could create an internal application that organizes outstanding invoice exceptions.
The application might retrieve approved invoice data, group unresolved issues by category, and display which items require further investigation.
Oracle App Composer manages the deployment environment, while IT controls approved data connections, permissions, and related infrastructure.
Oracle also announced support for APEXlang, a technology intended to make AI-assisted application development easier to maintain.
This matters because applications created through natural-language development still need understandable logic, testing, and long-term maintenance.
Will App Composer Replace SuiteScript?
No. App Composer and SuiteScript serve different purposes. SuiteScript implements custom operations inside NetSuite, including transaction validation, calculations, record processing, and integration logic, whereas App Composer supports creating and operating applications on OCI.
An application built with App Composer may interact with NetSuite through an approved integration, but it does not automatically replace SuiteScript logic or inherit unrestricted access to ERP records.
A custom pricing calculation maintained through SuiteScript should continue to enforce the correct pricing rules.
An App Composer application could present pricing exceptions or support employees reviewing those transactions, provided it uses an authorized connection.
What Controls Do Citizen Developers Need?
AI-assisted development makes it easier for employees to create applications, but businesses still need rules for publishing and maintaining them.
IT should establish requirements for source code review, testing, access permissions, ownership, and operational support.
Applications that modify financial records need additional validation and authorization.
An application that displays overdue invoices presents different risks from one that changes invoice amounts or initiates payment-related actions.
Oracle App Composer was announced in limited availability. Businesses should confirm eligibility and supported functionality before making it part of their production development plans.
What Is Included in Oracle AI SMB Bundle?
Oracle AI SMB Bundle combines AI tools, business applications, and Oracle Cloud Infrastructure credits for eligible small and midsize businesses.
The offering is designed to help businesses develop products while managing core operational activities.
Unlike Oracle AI Workspace, which focuses on cross-application access, the SMB Bundle packages selected tools and benefits under a free-to-start offering.
The Bundle’s Main Components
| Component | Included benefit or purpose |
|---|---|
| ChatGPT and Codex | AI-assisted planning, development, testing, and employee productivity |
| OCI credits | $12,000 in cloud credits annually, renewable for up to two additional years if eligible |
| ChatGPT credit | One-time $50 credit per user, for up to five users |
| NetSuite QuickStart | Free-tier access for core financial activities such as invoices, bills, and cash flow |
| Oracle App Composer | Free tier supporting up to 100 application deployments per month |
| Oracle AI Security Mesh | Security vulnerability assessment capabilities within the applicable offering |
| Oracle Cost Advisor for AI | Tools for monitoring and managing AI-related spending |
The OCI allocation could total up to $36,000 over three years, but renewal is conditional and credits are limited to eligible consumption.
The one-time ChatGPT credit is not the same as an unlimited ChatGPT Business subscription. Each component has its own access conditions, usage limits, and commercial terms.
How Does NetSuite QuickStart Fit Into the Bundle?
NetSuite QuickStart provides a starting point for managing core financial operations.
Smaller businesses need to track invoices, vendor bills, payments, and cash flow even when their primary focus is developing a new product.
QuickStart addresses these operational requirements, while Codex and OCI support application development and deployment.
As the business grows, its accounting requirements may expand into more complex financial management, reporting, additional entities, or integrations.
The bundle does not automatically include unlimited use of the complete NetSuite ERP product suite.
Who Is Eligible?
Oracle describes the AI SMB Bundle as a limited-availability offering requiring application review and approval.
The published program terms restrict eligibility to qualifying US businesses that are privately held, for-profit, and independent of larger companies.
Other restrictions apply, including exclusions affecting certain organization types and businesses with substantial prior Oracle Universal Credit consumption.
Each included product has separate usage conditions.
For an established NetSuite customer, this matters because the bundle is not automatically a discount or entitlement attached to an existing ERP subscription.
Businesses should verify eligibility and the applicable commercial terms rather than treating the advertised credits as universally available.
How Folio3 Supports NetSuite AI Readiness and Integration
The Oracle–OpenAI partnership creates new opportunities for NetSuite users to access financial information and coordinate business processes through AI.
However, businesses with extensive customizations, multiple subsidiaries, third-party integrations, and accumulated role permissions need to understand how these components interact.
Folio3’s NetSuite AI Connector Services support connecting external AI applications with NetSuite data and business operations.
Where custom operations are required, integration and development work must address the relevant records, permissions, validation rules, and execution requirements.
Folio3’s NetSuite implementation and optimization experience is also relevant when existing configuration problems affect AI readiness.
The assessment should establish whether the proposed AI functionality requires a new connection, an additional custom tool, changes to existing processes, or corrections to the underlying ERP environment.
Final Thoughts
The Oracle–OpenAI partnership introduces new ways for employees to work with enterprise information, build applications, and assess security risks.
Oracle AI Workspace is intended to reduce application switching by connecting ChatGPT with authorized business information and activities. Oracle App Composer provides another route for AI-assisted development, while Security Mesh brings advanced AI models into vulnerability assessment.
For eligible smaller businesses, the AI SMB Bundle packages development tools, NetSuite QuickStart, and cloud credits into a single offering.
For existing NetSuite customers, these developments make ERP governance more important rather than less.
Conversational access only works reliably when the underlying records are accurate, integration processes function correctly, and users have permissions appropriate to their responsibilities.
Before expanding AI access, NetSuite administrators should review existing roles, exposed tools, sensitive financial records, and transaction controls.
Those decisions determine whether AI improves how employees interact with their ERP while preserving the reliability and control required for business operations.
